Splunk rules: 27

name: Adobe ColdFusion Unauthenticated Arbitrary File Read
id: 695aceae-21db-4e7f-93ac-a52e39d02b93
version: 10
creation_date: '2023-08-23'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects potential exploitation of the Adobe ColdFusion vulnerability, CVE-2023-26360, which allows unauthenticated arbitrary file read.
    It monitors POST requests to the "/cf_scripts/scripts/ajax/ckeditor/*" endpoint using the Web datamodel.
    This activity can be significant due to the vulnerability's high CVSS score of 9.8, indicating severe risk.
    If confirmed malicious, it could lead to unauthorized data access, further attacks, or severe operational disruptions.
data_source:
    - Suricata
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    FROM datamodel=Web WHERE

    Web.url="*/cf_scripts/scripts/ajax/ckeditor/*"
    Web.status=200
    Web.http_method=POST

    BY Web.http_user_agent Web.status Web.http_method
       Web.url Web.url_length Web.src Web.dest

    | `drop_dm_object_name("Web")`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `adobe_coldfusion_unauthenticated_arbitrary_file_read_filter`
how_to_implement: This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache, Splunk for Nginx, or Splunk for Palo Alto.
known_false_positives: |-
    In the wild, we have observed three different types of attempts that could potentially trigger false positives if the HTTP status code is not in the query.
    These include:

    - "/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/iedit.cfc?method=wizardHash&_cfclient=true&returnFormat=wddx&inPassword=foo"
    - "/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/uploadedFiles/2U9Uyvv qwP4PGaZpjARz5VJGfpCk.jsp"
    - "/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm"

    These could be legitimate requests depending on the context of your organization. Therefore, it is recommended to modify the analytic as needed to suit your specific environment.
references:
    - https://www.rapid7.com/db/modules/auxiliary/gather/adobe_coldfusion_fileread_cve_2023_26360/
    - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-26360.yaml
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: Possible exploitation of CVE-2023-26360 against $dest$ via $url$.
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Adobe ColdFusion Arbitrary Code Execution CVE-2023-29298 CVE-2023-26360
asset_type: Network
cve:
    - CVE-2023-26360
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: AWS Exfiltration via Bucket Replication
id: eeb432d6-2212-43b6-9e89-fcd753f7da4c
version: 10
creation_date: '2023-04-28'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic detects API calls to enable S3 bucket replication services. It leverages AWS CloudTrail logs to identify `PutBucketReplication` events, focusing on fields like `bucketName`, `ReplicationConfiguration.Rule.Destination.Bucket`, and user details. This activity is significant as it can indicate unauthorized data replication, potentially leading to data exfiltration. If confirmed malicious, attackers could replicate sensitive data to external accounts, leading to data breaches and compliance violations.
data_source:
    - AWS CloudTrail PutBucketReplication
search: |-
    `cloudtrail`  eventName = PutBucketReplication eventSource = s3.amazonaws.com
      | rename user_name as user, requestParameters.ReplicationConfiguration.Rule.Destination.Bucket as bucket_name
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product bucket_name
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_exfiltration_via_bucket_replication_filter`
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
known_false_positives: It is possible that an AWS admin has legitimately implemented data replication to ensure data availability and improve data protection/backup strategies.
references:
    - https://hackingthe.cloud/aws/exploitation/s3-bucket-replication-exfiltration/
finding:
    title: AWS Bucket Replication rule added to $bucket_name$ by user $user$ from IP Address - $src$
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Suspicious AWS S3 Activities
    - Data Exfiltration
asset_type: EC2 Snapshot
mitre_attack_id:
    - T1537
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

id: '5693.5955'
title: Common Exchange Recon cmdlets
description: 'Detect Common Exchange cmdlet reconnaissance commands used by attackers
  in order to collect information and/or to spread malware within the network after
  gaining access to a machine. - Threat Actor Association: APT29/Nobelium/Cozy Bear,
  CL-STA-0043 - Software Association: DatopLoader'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  TERM(EventCode=4103)) (TERM(Get-AcceptedDomain) OR TERM(Get-CASMailbox) TERM(Get-Mailbox)
  OR TERM(Get-ManagementRoleAssignment) OR TERM(Get-OrganizationConfig) OR TERM(Get-MailboxExportRequest)
  OR TERM(Get-OwaVirtualDirectory) OR TERM(Get-WebServicesVirtualDirectory) OR TERM(Get-MailboxRegionalConfiguration)
  OR TERM(Get-ExchangeServer) OR TERM(Get-InboxRule) OR TERM(Get-MailboxPermission))
  | table _time, host, user signature_id, process, process_* `group_events("host",1s)` '
techniques:
- execution:command and scripting interpreter:powershell
- discovery:account discovery:email account
technique_id:
- T1087.003
- T1059.001
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/

name: Disable UAC Remote Restriction
id: 9928b732-210e-11ec-b65e-acde48001122
version: 14
creation_date: '2021-09-29'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects the modification of the registry to disable UAC remote restriction by setting the "LocalAccountTokenFilterPolicy" value to "0x00000001". It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path "*\\CurrentVersion\\Policies\\System*". This activity is significant because disabling UAC remote restriction can allow an attacker to bypass User Account Control (UAC) protections, potentially leading to privilege escalation. If confirmed malicious, this could enable an attacker to execute unauthorized actions with elevated privileges, compromising the security of the affected system.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\CurrentVersion\\Policies\\System*" Registry.registry_value_name="LocalAccountTokenFilterPolicy" Registry.registry_value_data="0x00000001"  ) by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `drop_dm_object_name(Registry)`| where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_uac_remote_restriction_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin may set this policy for non-critical machine.
references:
    - https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/user-account-control-and-remote-restriction
finding:
    title: Modified/added/deleted registry entry $registry_path$ on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Modified/added/deleted registry entry $registry_path$ on $dest$
analytic_story:
    - Suspicious Windows Registry Activities
    - Windows Defense Evasion Tactics
    - CISA AA23-347A
    - Windows Registry Abuse
asset_type: Endpoint
mitre_attack_id:
    - T1548.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: ESXi Malicious VIB Forced Install
id: 5d4d2cd2-7b65-4474-97cf-e9b203bcd770
version: 5
creation_date: '2025-07-11'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: Detects potentially malicious installation of VMware Installation Bundles (VIBs) using the --force flag. The --force option bypasses signature and compatibility checks, allowing unsigned, community-supported, or incompatible VIBs to be installed on an ESXi host. This behavior is uncommon in normal administrative operations and is often observed in post-compromise scenarios where adversaries attempt to install backdoored or unauthorized kernel modules, drivers, or monitoring tools to establish persistence or gain deeper control of the hypervisor.
data_source:
    - VMWare ESXi Syslog
search: '`esxi_syslog` Message="* image profile with validation disabled. *" OR Message="* image profile bypassing signing and acceptance level verification. *" OR Message="* vib without valid signature, *" | rex field=_raw "Z (?<dest>[\w\.]+)\s" | stats min(_time) as firstTime max(_time) as lastTime count by dest Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `esxi_malicious_vib_forced_install_filter`'
how_to_implement: This is based on syslog data generated by VMware ESXi hosts. To implement this search, you must configure your ESXi systems to forward syslog output to your Splunk deployment. These logs must be ingested with the appropriate Splunk Technology Add-on for VMware ESXi Logs, which provides field extractions and CIM compatibility.
known_false_positives: Some third party vendor VIBs or patches may require the force option.
references:
    - https://detect.fyi/detecting-and-responding-to-esxi-compromise-with-splunk-f33998ce7823
finding:
    title: A VIB was installed on ESXi $dest$ with the force flag.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - ESXi Post Compromise
    - Black Basta Ransomware
    - China-Nexus Threat Activity
asset_type: Infrastructure
mitre_attack_id:
    - T1505.006
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: endpoint

id: '31175.55799'
title: ETW Trace Provider Modified - PowerShell
description: Event Tracing for Windows (ETW) trace providers are components that generate
  events for logging allowing for monitoring and diagnosis of Windows system and application
  behaviors. Threat actors may alter ETW trace provides to modify or disable logging
  capabilities, thereby evading detection and maintaining persistence in a compromised
  system. This use case detects commands targeting ETW providers, specifically targeting
  events related to adding or modifying event trace providers.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") (TERM(Remove-EtwTraceProvider)
  OR (TERM(Set-EtwTraceProvider) "0x11")) OR ("System.Management.Automation.Tracing.PSEtwLogProvider"
  "m_enabled") | table _time, host, user, parent_process_name, process_name, process
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:impair defenses:indicator blocking
- defense-evasion:indicator removal
technique_id:
- T1562.006
- T1070
data_category:
- PowerShell logs
references:
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://gist.github.com/tandasat/e595c77c52e13aaee60e1e8b65d2ba32
- https://detection.fyi/sigmahq/sigma/windows/powershell/powershell_script/posh_ps_etw_trace_evasion/

name: Get-DomainTrust with PowerShell Script Block
id: 89275e7e-0548-11ec-bf75-acde48001122
version: 12
creation_date: '2021-09-02'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the execution of the Get-DomainTrust command from PowerView using PowerShell Script Block Logging (EventCode=4104). This method captures the full command sent to PowerShell, allowing for detailed inspection. Identifying this activity is significant because it may indicate an attempt to gather domain trust information, which is often a precursor to lateral movement or privilege escalation. If confirmed malicious, this activity could enable an attacker to map trust relationships within the domain, potentially leading to further exploitation and compromise of additional systems.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 ScriptBlockText = "*get-domaintrust*"
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `get_domaintrust_with_powershell_script_block_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: It is possible certain system management frameworks utilize this command to gather trust information.
references:
    - https://blog.harmj0y.net/redteaming/a-guide-to-attacking-domain-trusts/
    - https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
    - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
    - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
    - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
finding:
    title: Suspicious PowerShell Get-DomainTrust was identified on endpoint $dest$ by user $user_id$.
    entity:
        field: user_id
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Suspicious PowerShell Get-DomainTrust was identified on endpoint $dest$ by user $user_id$.
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1482
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: High Volume of Bytes Out to Url
id: c8a6b56d-16dd-4e9c-b4bd-527742ead98d
version: 10
creation_date: '2024-03-06'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: Anomaly
description: The following analytic detects a high volume of outbound web traffic, specifically over 1GB of data sent to a URL within a 2-minute window. It leverages the Web data model to identify significant uploads by analyzing the sum of bytes out. This activity is significant as it may indicate potential data exfiltration by malware or malicious insiders. If confirmed as malicious, this behavior could lead to unauthorized data transfer, resulting in data breaches and loss of sensitive information. Immediate investigation is required to determine the legitimacy of the transfer and mitigate any potential threats.
data_source:
    - Nginx Access
search: |-
    | tstats  `security_content_summariesonly` count sum(Web.bytes_out) as sum_bytes_out values(Web.user) as user values(Web.app) as app values(Web.dest) as dest FROM datamodel=Web
      BY _time span=2m Web.url
         Web.src sourcetype
    | search sum_bytes_out > 1070000000
    | `drop_dm_object_name("Web")`
    | `high_volume_of_bytes_out_to_url_filter`
how_to_implement: To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the `Web` datamodel. Please adjust the threshold for the sum of bytes out as per your environment and user behavior.
known_false_positives: This search may trigger false positives if there is a legitimate reason for a high volume of bytes out to a URL. We recommend to investigate these findings. Consider updating the filter macro to exclude the applications that are relevant to your environment.
references:
    - https://attack.mitre.org/techniques/T1567/
    - https://www.trendmicro.com/en_us/research/20/l/pawn-storm-lack-of-sophistication-as-a-strategy.html
    - https://www.bleepingcomputer.com/news/security/hacking-group-s-new-malware-abuses-google-and-facebook-services/
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: A high volume of bytes out to a URL $url$ was detected from src $src$ to dest $dest$.
threat_objects:
    - field: dest
      type: ip_address
analytic_story:
    - Data Exfiltration
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1567
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: JetBrains TeamCity Limited Auth Bypass Suricata CVE-2024-27199
id: a1e68dcd-2e24-4434-bd0e-b3d4de139d58
version: 9
creation_date: '2024-03-06'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies attempts to exploit CVE-2024-27199, a critical vulnerability in JetBrains TeamCity web server, allowing unauthenticated access to specific endpoints. It detects unusual access patterns to vulnerable paths such as /res/, /update/, and /.well-known/acme-challenge/ by monitoring HTTP traffic logs via Suricata. This activity is significant as it could indicate an attacker bypassing authentication to access or modify system settings. If confirmed malicious, this could lead to unauthorized changes, disclosure of sensitive information, or uploading of malicious certificates, severely compromising the server's security.
data_source:
    - Suricata
search: |-
    `suricata` http.url IN ("*../admin/diagnostic.jsp*", "*../app/https/settings/*", "*../app/pipeline*", "*../app/oauth/space/createBuild.html*", "*../res/*", "*../update/*", "*../.well-known/acme-challenge/*", "*../app/availableRunners*", "*../app/https/settings/setPort*", "*../app/https/settings/certificateInfo*", "*../app/https/settings/defaultHttpsPort*", "*../app/https/settings/fetchFromAcme*", "*../app/https/settings/removeCertificate*", "*../app/https/settings/uploadCertificate*", "*../app/https/settings/termsOfService*", "*../app/https/settings/triggerAcmeChallenge*", "*../app/https/settings/cancelAcmeChallenge*", "*../app/https/settings/getAcmeOrder*", "*../app/https/settings/setRedirectStrategy*") http.status=200 http_method=GET
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY src, dest, http_user_agent,
           http.url, http.status, http_method
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `jetbrains_teamcity_limited_auth_bypass_suricata_cve_2024_27199_filter`
how_to_implement: The following detection relies on the Suricata TA and ensuring it is properly configured to monitor HTTP traffic. Modify the query for your environment and log sources as needed.
known_false_positives: False positives are not expected, however, monitor, filter, and tune as needed based on organization log sources. The analytic is restricted to 200 and GET requests to specific URI paths, which should limit false positives.
references:
    - https://github.com/projectdiscovery/nuclei-templates/blob/f644ec82dfe018890c6aa308967424d26c0f1522/http/cves/2024/CVE-2024-27199.yaml
    - https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/
    - https://blog.jetbrains.com/teamcity/2024/03/teamcity-2023-11-4-is-out/
    - https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/
finding:
    title: Possible JetBrains TeamCity Limited Authentication Bypass Attempt against $dest$ from $src$.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - JetBrains TeamCity Vulnerabilities
asset_type: Web Server
cve:
    - CVE-2024-27199
mitre_attack_id:
    - T1190
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: web
security_domain: network

name: Linux Dirty Frag Kernel Privilege Escalation
id: 517e7bf8-d0aa-46ac-80e1-f9f498944b71
version: 1
creation_date: '2026-07-06'
modification_date: '2026-07-06'
author: Axsel Riando Soplanit, Alexander Wijaya, Matthew Roytua, Muhammad Rafdi Aufar Ahmad, Brian Stevan Ambarita, Ensign Infosecurity
status: production
type: TTP
description: |-
    The following analytic detects exploitation of Dirty Frag (CVE-2026-43284 and CVE-2026-43500), a Linux kernel local privilege escalation vulnerability.
    The exploit corrupts the kernel page cache via the IPsec ESP or RxRPC subsystems using a high-frequency splice() syscall loop, followed by a privilege transition to root in the same audit session.
    This analytic anchors on the exploit-specific behavioral signature, a sustained splice() spray (50 or more calls within a 60-second window) from an unprivileged process executing from a user-writable path (/home, /tmp, /dev/shm, /var/tmp, /run/user, /root), followed within 5 minutes by execution of a set-uid binary in the same auditd session.
data_source:
    - Linux Auditd Syscall
search: |-
    `linux_auditd`
    type=SYSCALL
    key=splice_user
    exe IN (
        "/home/*",
        "/tmp/*",
        "/var/tmp/*",
        "/dev/shm/*",
        "/run/user/*",
        "/root/*"
    )

    | bin _time span=60s
    | eval user = coalesce(user, auid, AUID)

    | stats count AS splice_count
            values(exe) AS spray_binary
            values(pid) AS spray_pid
            values(user) AS user
            earliest(_time) AS spray_start
            latest(_time) AS spray_end
      BY auid host ses _time

    | where splice_count >= 50

    | join type=inner auid host ses [
        search `linux_auditd`
        type=SYSCALL
        key=process_creation
        exe IN (
            "/usr/bin/chfn",
            "/usr/bin/chsh",
            "/usr/bin/fusermount3",
            "/usr/bin/gpasswd",
            "/usr/bin/mount",
            "/usr/bin/newgrp",
            "/usr/bin/passwd",
            "/usr/bin/su",
            "/usr/bin/sudo",
            "/usr/bin/umount",
            "/usr/lib/dbus-1.0/dbus-daemon-launch-helper",
            "/usr/lib/landscape/apt-update",
            "/usr/lib/openssh/ssh-keysign",
            "/usr/lib/polkit-1/polkit-agent-helper-1"
        )

        | stats earliest(_time) AS privesc_time
                values(exe) AS privesc_binary
                values(comm) AS privesc_comm
                values(ppid) AS privesc_ppid
          BY auid host ses
    ]

    | eval window_secs = privesc_time - spray_end
    | where window_secs >= 0 AND window_secs <= 300

    | `security_content_ctime(spray_start)`
    | `security_content_ctime(spray_end)`
    | `security_content_ctime(privesc_time)`

    | rename host AS dest

    | table dest user auid ses spray_binary spray_pid
            splice_count spray_start spray_end privesc_binary
            privesc_comm privesc_ppid privesc_time window_secs

    | `linux_dirty_frag_kernel_privilege_escalation_filter`
how_to_implement: |-
    This analytic requires Linux auditd telemetry forwarded to Splunk
    via the Splunk_TA_nix add-on with the linux_audit sourcetype (referenced through
    the linux_auditd macro).

    The detection depends on two audit rule keys, both of which
    are standard in the Neo23x0 recommended ruleset (https://github.com/Neo23x0/auditd)
    and the existing ESCU Copy Fail analytic (Linux Auditd Copy Fail Privilege Escalation),
    so no detection-specific custom keys are introduced.


    PREREQUISITE 1; splice_user key.

    -a always,exit -F arch=b64 -S splice -S vmsplice -F success=1 -F auid>=1000 -F auid!=unset
    -k splice_user
    -a always,exit -F arch=b32 -S splice -S vmsplice -F success=1 -F auid>=1000 -F auid!=unset
    -k splice_user

    Operators should baseline splice volume in their environment before enabling.
    Hosts running heavy zero-copy I/O workloads (specific: web servers, mail transfer agents, container runtimes) may need additional filtering.

    PREREQUISITE 2; process_creation key.

    -a always,exit -F arch=b64 -S execve -S execveat -F auid>=1000 -F auid!=unset -k
    process_creation
    -a always,exit -F arch=b32 -S execve -S execveat -F auid>=1000 -F auid!=unset -k
    process_creation
known_false_positives: |-
    The splice volume threshold (50 calls per 60 seconds from a single process in a user-writable path) is calibrated against the V4bel public PoC, which produces 100-460 splice calls in 90 seconds depending on system state.
    Legitimate user-mode workloads that may produce splice() calls (web servers, mail transfer agents, language runtimes) typically execute from system paths (/usr/sbin, /usr/bin, /usr/lib) and are excluded by the user-writable path filter.
    Custom-compiled applications, developer test binaries, or container runtimes executing from /home or /tmp could theoretically reach the volume threshold during legitimate I/O-heavy workloads (large file copies, log rotation, archive operations).
    Operators should baseline splice volume in their environment before enabling as a notable event. If false positives occur, add an allowlist of trusted binary paths via the linux_dirty_frag_kernel_privilege_escalation_filter macro, or raise the splice_count threshold based on observed legitimate-workload baseline.
references:
    - https://www.cve.org/CVERecord?id=CVE-2026-43284
    - https://www.cve.org/CVERecord?id=CVE-2026-43500
    - https://www.cve.org/CVERecord?id=CVE-2026-31431
    - https://github.com/V4bel/dirtyfrag
    - https://www.openwall.com/lists/oss-security/2026/05/07/8
    - https://www.microsoft.com/en-us/security/blog/2026/05/08/active-attack-dirty-frag-linux-vulnerability-expands-post-compromise-risk/
    - https://attack.mitre.org/techniques/T1068/
    - https://attack.mitre.org/techniques/T1548/001/
finding:
    title: Local privilege escalation attempt detected on $dest$ executed by $user$ using $spray_binary$
    entity:
        field: dest
        type: system
        score: 50
intermediate_findings:
    entities:
        - field: user
          type: user
          score: 50
          message: Local privilege escalation attempt detected on $dest$ executed by $user$ using $spray_binary$
threat_objects:
    - field: spray_binary
      type: process_name
analytic_story:
    - Linux Privilege Escalation
asset_type: Endpoint
cve:
    - CVE-2026-43284
    - CVE-2026-43500
    - CVE-2026-31431
mitre_attack_id:
    - T1548.001
    - T1068
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Disable Services
id: f2e08a38-6689-4df4-ad8c-b51c16262316
version: 10
creation_date: '2022-04-26'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects attempts to disable a service on a Linux system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on processes like "systemctl," "service," and "svcadm" with commands containing "disable." This activity is significant as adversaries may disable security or critical services to evade detection and facilitate further malicious actions, such as deploying destructive payloads. If confirmed malicious, this could lead to the termination of essential security services, allowing attackers to persist undetected and potentially cause significant damage to the system.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name IN ("systemctl", "service", "svcadm")  Processes.process = "* disable*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_disable_services_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
    - https://cert.gov.ua/article/39518
finding:
    title: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable services on endpoint $dest$ by $user$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - AwfulShred
    - Data Destruction
    - Industroyer2
asset_type: Endpoint
mitre_attack_id:
    - T1489
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Stdout Redirection To Dev Null File
id: de62b809-a04d-46b5-9a15-8298d330f0c8
version: 14
creation_date: '2022-04-07'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects command-line activities that redirect stdout or stderr to the /dev/null file. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. This behavior is significant as it can indicate attempts to hide command outputs, a technique observed in the CyclopsBlink malware to conceal modifications to iptables firewall settings. If confirmed malicious, this activity could allow an attacker to stealthily alter system configurations, potentially leading to unauthorized access or persistent control over the compromised machine.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process = "*&>/dev/null*"
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_stdout_redirection_to_dev_null_file_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf
    - https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: a commandline $process$ that redirect stdout to dev/null on $dest$
analytic_story:
    - Cyclops Blink
    - Data Destruction
    - Industroyer2
asset_type: Endpoint
mitre_attack_id:
    - T1686
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Sudo OR Su Execution
id: 4b00f134-6d6a-11ec-a90c-acde48001122
version: 10
creation_date: '2022-01-10'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: The following analytic detects the execution of the "sudo" or "su" command on a Linux operating system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent process names. This activity is significant because "sudo" and "su" commands are commonly used by adversaries to elevate privileges, potentially leading to unauthorized access or control over the system. If confirmed malicious, this activity could allow attackers to execute commands with root privileges, leading to severe security breaches, data exfiltration, or further system compromise.
data_source:
    - Sysmon for Linux EventID 1
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE Processes.process_name IN ("sudo", "su")
        OR
        Processes.parent_process_name IN ("sudo", "su")
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_sudo_or_su_execution_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
references:
    - https://attack.mitre.org/techniques/T1548/003/
analytic_story:
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - VoidLink Cloud-Native Linux Malware
asset_type: Endpoint
mitre_attack_id:
    - T1548.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Local Account Discovery With Wmic
id: 4902d7aa-0134-11ec-9d65-acde48001122
version: 11
creation_date: '2021-08-24'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: Hunting
description: The following analytic detects the execution of `wmic.exe` with command-line arguments used to query local user accounts, specifically the `useraccount` argument. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant as it indicates potential reconnaissance efforts by adversaries to enumerate local users, which is a common step in situational awareness and Active Directory discovery. If confirmed malicious, this behavior could lead to further targeted attacks, privilege escalation, or lateral movement within the network.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE `process_wmic` (Processes.process=*useraccount*)
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `local_account_discovery_with_wmic_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Administrators or power users may use this command for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1087/001/
analytic_story:
    - Active Directory Discovery
    - Scattered Lapsus$ Hunters
asset_type: Endpoint
mitre_attack_id:
    - T1087.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5998.6375'
title: Logon Script Registry Key added
description: 'Adversaries may use Windows logon scripts automatically executed at
  logon initialization to establish persistence. '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4104) (TERM(reg)
  OR "reg.exe") TERM(add) TERM(UserInitMprLogonScript) | table _time, host, user process,
  process_*, singature_id | bin span=1s | stats values(*) as * by _time, host '
techniques:
- persistence:boot or logon initialization scripts:logon script (windows)
- privilege-escalation:boot or logon initialization scripts:logon script (windows)
technique_id:
- T1037.001
data_category:
- PowerShell logs
references:
- https://blog.morphisec.com/cobalt-gang-2.0

name: MacOS Kextload Usage
id: 9d680775-84a6-4625-a8ea-8182b9427ce4
version: 3
creation_date: '2026-04-14'
modification_date: '2026-05-13'
author: Raven Tait, Splunk
status: production
type: TTP
description: |-
    Detects execution of the kextload command on macOS systems. The kextload utility is used to manually load kernel extensions (KEXTs) into the macOS kernel, which can introduce privileged code at the kernel level.
    While legitimate for driver installation and system administration, misuse may indicate attempts to install unauthorized, malicious, or persistence-enabling kernel extensions.
data_source:
    - Osquery Results
search: |-
    | tstats `security_content_summariesonly`
      count min(_time) as firstTime
            max(_time) as lastTime

    from datamodel=Endpoint.Processes where

    Processes.process_name = "kextload"

    AND NOT

    Processes.process IN (
        "*-help*",
        "* -h *"
    )

    by Processes.dest Processes.original_file_name Processes.parent_process_id
       Processes.process Processes.process_exec Processes.process_guid
       Processes.process_hash Processes.process_id
       Processes.process_current_directory Processes.process_name
       Processes.process_path Processes.user
       Processes.user_id Processes.vendor_product

    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `macos_kextload_usage_filter`
how_to_implement: |-
    This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
    Also the [TA-OSquery](https://splunkbase.splunk.com/app/8574) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the data models.
known_false_positives: |-
    Administrators installing new drivers could use this application.
references:
    - https://osquery.readthedocs.io/en/stable/deployment/process-auditing/
    - https://www.unix.com/man_page/osx/8/kextload/
finding:
    title: Possible kernel extension loaded on $dest$ by $user$ via $process$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Possible kernel extension loaded on $dest$ by $user$ via $process$
threat_objects:
    - field: process
      type: process
analytic_story:
    - MacOS Privilege Escalation
    - MacOS Persistence Techniques
asset_type: Endpoint
mitre_attack_id:
    - T1543
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '5869.6200'
title: Obfuscated Powershell Techniques
description: 'Attackers and commodity malware have started using extremely basic obfuscation
  techniques to hide the majority of the command from the command line arguments of
  powershell.exe. This use case relies on URL Toolbox to function. -- Software Association:
  AsyncRAT, Midas --'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` EventCode=4103 (Invoke-Expression
  OR Invoke-Command OR Invoke-WebRequest)| rex field=Message "(?i)\"Command\"\;\svalue=\"?(?<obfuscated_cmd>.+.\)?\")"
  | rex field=Message "(?i)script\s+name\s+?\=(?<script_name>.+\.ps1)" | regex obfuscated_cmd!="(?i)(\.ps1|powershell)"|
  regex obfuscated_cmd=".{25,}" |`ut_shannon(obfuscated_cmd)` | table _time, host,
  user process, process_*, signature_id, user, obfuscated_cmd, ut_shannon, script_name
  | bin span=1s | stats values(*) as * by _time, host | where ut_shannon > 4 OR match(obfuscated_cmd,
  "\s{30}") OR match(obfuscated_cmd, "\W{30}") OR (match(obfuscated_cmd, "(\s?\d{1,8}(\s+|\,)(\s+|\,)?){15}"))
  OR match(obfuscated_cmd, "(?i)bxor") '
techniques:
- defense-evasion:obfuscated files or information
- command-and-control:data obfuscation
technique_id: 
- T1027
- T1001
data_category:
- Windows event logs
- PowerShell logs
references:
- https://github.com/danielbohannon/Invoke-Obfuscation
- https://github.com/oddcod3/Phantom-Evasion

id: '16938.27404'
title: Potential CVE-2023-23397
description: 'Microsoft Office Outlook contains a privilege escalation vulnerability
  that allows for a NTLM Relay attack against another service to authenticate as the
  user. This use case looks for svchost spawning rundll with DavSetCookie, which may
  indicate successfull execution of CVE-2023-23397 -- Threat Actor Association: APT28
  (Fancy Bear, Forest Blizzard, STRONTIUM)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<"
  OR Type=Process) "svchost.exe" "rundll32" "davclnt.dll" "DavSetCookie" | regex process="(?i)(davclnt.dll.*DavSetCookie.*://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
  | table _time, host, user process, process_*, signature_id, parent_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- privilege-escalation:process injection:dynamic-link library injection
- exfiltration:exfiltration over alternative protocol:exfiltration over unencrypted
  non-c2 protocol
technique_id:
- T1048.003
- T1055.001
data_category:
- Windows Sysmon
references:
- https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/
- https://twitter.com/aceresponder/status/1636116096506818562
- https://www.huntress.com/blog/everything-we-know-about-cve-2023-23397?utm_content=241922884&utm_medium=social&utm_source=twitter&hss_channel=tw-3330464153

id: '35597.62476'
title: WebDAV LNK Execution
description: Threat actors often place malicious payloads on remote servers, which
  are then downloaded and executed on the user’s PC using scripts or other methods.
  One type of server attackers can leverage is WebDAV (Web Distributed Authoring and
  Versioning) — a file transfer protocol built on top of HTTP. Threat actors can exploit
  this technique by creating LNK files that, when accessed through Windows Explorer,
  execute commands or scripts, enabling remote code execution and further malicious
  activities. This use case detects when a LNK file was possibly executed from a WebDAV
  server by a user who might have been tricked into accessing a URL shortcut.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "explorer.exe" ("cmd.exe" OR "cscript.exe" OR "mshta.exe" OR "powershell.exe" OR
  "pwsh.exe" OR "wscript.exe") TERM(DavWWWRoot) | regex parent_process_name="(?i)explorer\.exe"
  | regex process_name="(?i)(cmd|(c|w)script|mshta|powershell|pwsh)\.exe"| regex process="(?i)DavWWWRoot"
  | table _time, host, user, parent_*, process, process_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- execution:command and scripting interpreter:powershell
- execution:user execution
- execution:command and scripting interpreter:windows command shell
technique_id:
- T1059.001
- T1204
- T1059.003
data_category:
- Windows Sysmon
references:
- https://www.trellix.com/blogs/research/beyond-file-search-a-novel-method/
- https://micahbabinski.medium.com/search-ms-webdav-and-chill-99c5b23ac462
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_webdav_lnk_execution.yml
- https://attack.mitre.org/techniques/T1059/001/
- https://attack.mitre.org/techniques/T1059/003/
- https://attack.mitre.org/techniques/T1204/
- https://any.run/cybersecurity-blog/client-side-exploitation/

name: Windows Access Token Winlogon Duplicate Handle In Uncommon Path
id: b8f7ed6b-0556-4c84-bffd-839c262b0278
version: 12
creation_date: '2022-09-01'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects a process attempting to duplicate the handle of winlogon.exe from an uncommon or public source path. This is identified using Sysmon EventCode 10, focusing on processes targeting winlogon.exe with specific access rights and excluding common system paths. This activity is significant because it may indicate an adversary trying to escalate privileges by leveraging the high-privilege tokens associated with winlogon.exe. If confirmed malicious, this could allow the attacker to gain elevated access, potentially leading to full system compromise and persistent control over the affected host.
data_source:
    - Sysmon EventID 10
search: '`sysmon` EventCode=10  TargetImage IN("*\\system32\\winlogon.exe*", "*\\SysWOW64\\winlogon.exe*") AND GrantedAccess = 0x1040 AND NOT (SourceImage IN("C:\\Windows\\*", "C:\\Program File*", "%systemroot%\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by CallTrace EventID GrantedAccess Guid Opcode ProcessID SecurityID SourceImage SourceProcessGUID SourceProcessId TargetImage TargetProcessGUID TargetProcessId UserID dest granted_access parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_access_token_winlogon_duplicate_handle_in_uncommon_path_filter`'
how_to_implement: To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: It is possible legitimate applications will request access to winlogon, filter as needed.
references:
    - https://docs.microsoft.com/en-us/windows/win32/api/handleapi/nf-handleapi-duplicatehandle
    - https://attack.mitre.org/techniques/T1134/001/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A process $SourceImage$ is duplicating the handle token of winlogon.exe on $dest$
threat_objects:
    - field: SourceImage
      type: process_name
analytic_story:
    - Brute Ratel C4
    - PathWiper
asset_type: Endpoint
mitre_attack_id:
    - T1134.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Browser Process Launched with Unusual Flags
id: 841e2abc-0442-4e7f-b445-b22680632a08
version: 5
creation_date: '2023-09-19'
modification_date: '2026-06-25'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the use of unusual browser flags, specifically --mute-audio and --do-not-elevate, which deviate from standard browser launch behavior. These flags may indicate automated scripts, testing environments, or attempts to modify browser functionality for silent operation or restricted privilege execution. Detection focuses on non-standard launch parameters, unexpected process behavior, or deviations from baseline configurations. Monitoring such flag usage helps identify potentially suspicious activity, misconfigurations, or policy violations, enabling security teams to investigate anomalies, ensure system compliance, and differentiate legitimate administrative or testing uses from unusual or unauthorized operations.
data_source:
    - Sysmon EventID 1
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where NOT (Processes.parent_process_name IN ("chrome.exe", "msedge.exe", "brave.exe", "firefox.exe", "explorer.exe")) AND NOT (Processes.parent_process_path IN("C:\\Program Files*", "C:\\Windows\\System32\\*", "C:\\Windows\\SysWow64\\*",)) AND Processes.process_name IN ("chrome.exe", "msedge.exe", "brave.exe", "firefox.exe") AND Processes.process IN ("*--mute-audio*","*--no-de-elevate*", "*--do-not-de-elevate*", "*--disable-audio*") by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id Processes.vendor_product | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_browser_process_launched_with_unusual_flags_filter`'
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: It is possible false positives will be present based on third party applications. Filtering may be needed.
references:
    - https://www.recordedfuture.com/research/from-castleloader-to-castlerat-tag-150-advances-operations
    - https://peter.sh/experiments/chromium-command-line-switches/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: chromium browser that has unusual flags for muting or audio and prevent de-elevation of the current process in $dest$.
threat_objects:
    - field: parent_process_name
      type: parent_process_name
analytic_story:
    - Castle RAT
    - Phantom Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1185
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint